"Stuart D. Gathman" commented:
I would like to reiterate
my desire (which doesn't seem to be shared by anyone else so far)
that any RFC2822 checks are based on the validated the 2821 MAIL FROM.
I'm with you, FWIW. In a post a few days ago I declared my view that any 2822
inspections / tests should take place only after a 'pass' result from the 2821
MAIL-FROM test. This was when we were discussing the legality of transports
inspecting 2822 contents. I did have an additional requirement - that the sender
had published a policy component which implicitly gave the inspector authority
to inspect the DATA part.
Chris Haynes